CVE-2026-101887 in bluez-alsa
Summary
by MITRE • 10/01/2026
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The BlueALSA project, which serves as an implementation of the Advanced Audio Distribution Profile for Bluetooth systems using ALSA audio drivers, contains a critical division-by-zero vulnerability within its LC3plus sink decoder component. This flaw is located specifically in the file a2dp-lc3plus.c and affects the function a2dp_lc3plus_dec_thread, which is responsible for processing incoming media streams. The vulnerability arises from insufficient validation of input data fields before they are used in arithmetic operations. Specifically, when handling LC3plus encoded audio frames, the decoder fails to verify that the frame count field within the RTP media header is non-zero prior to performing a division operation involving this value. This lack of boundary checking creates an exploitable condition where maliciously crafted inputs can trigger a fatal exception during runtime execution.
From a technical perspective, the exploitation vector requires an attacker to be Bluetooth-adjacent, meaning they must have proximity and connectivity capabilities within the local wireless network environment. The attack sequence begins with the establishment of an Advanced Audio Distribution Profile source connection against a victim system running bluealsad as an A2DP sink. Once the LC3plus audio session is successfully negotiated between the attacker's device and the target, the adversary transmits a non-fragmented LC3plus media header containing a frame count field explicitly set to zero. Upon receiving this packet, the decoding thread attempts to process the stream but encounters the division-by-zero condition when calculating buffer sizes or processing intervals based on the invalid frame count. This arithmetic error results in a SIGFPE signal being sent to the bluealsad daemon process.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity, classifying it as a denial-of-service attack vector. The generation of the SIGFPE signal causes immediate termination of the affected thread and potentially the entire bluealsad service depending on how the main application handles child process failures. This results in an abrupt cessation of audio playback capabilities for any applications relying on BlueALSA for Bluetooth audio output. For users who have compiled their systems with LC3plus support enabled, this flaw effectively renders high-quality low-complexity codec functionality unusable until the service is manually restarted or the system is rebooted. The impact extends beyond mere inconvenience; in environments where continuous audio streaming is critical, such as digital signage or industrial control interfaces utilizing Bluetooth audio outputs, this crash can disrupt operations significantly.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-369, which describes a divide-by-zero error that occurs when an application divides by zero without proper validation of the divisor. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this exploit maps to T1499 Endpoint Denial of Service, specifically leveraging resource exhaustion or service disruption through software vulnerabilities rather than overwhelming traffic volume. The attack does not require privilege escalation as it targets a system daemon that typically runs with elevated privileges relative to user applications but is itself the target of the crash.
Mitigation strategies for this vulnerability involve both immediate patching and long-term architectural improvements. Users should update their BlueALSA installations to versions where the division-by-zero check has been implemented in the LC3plus decoder thread. Developers must ensure that all input fields derived from external network sources, particularly those influencing arithmetic logic, are validated against expected ranges before use. Implementing strict type checking and range validation for RTP header fields such as frame count is essential to prevent similar issues across other codecs supported by BlueALSA. Additionally, deploying the daemon with robust signal handling mechanisms can help isolate crashes in individual threads from bringing down the entire service, thereby improving resilience even if a vulnerability exists within a specific codec implementation.